A device which must exports things to userland (ioctls, defines)
should only
do so from a file which contain those parts only. Only this file
may be placed
under /usr/include. The driver should include said file to get
access to those bits.

This is just following the simple rules of separating interface
from implementation.

Having said that, given <sys/gpio.h> is already in netbsd 5, it's
too late to move.

Actually I think sys/gpio.h is at the right place, but dev/
keylock.h is not. dev/keylock.h should actually be split into two
files, one containing the internal parts, dev/keylock.h, and one
containing the public parts in sys/keylock.h

dev/keylock.h - public
dev/keylockvar.h - private
No reason to move it into sys. Let's try to keep devices out of sys.

Maybe the more important part being files be split into private/public
parts than where they reside.

keylock, btw, is not a device, like gpio or audio are not strictly
devices. They are mere abstractions, no hardware associated with
those. They rely, however, on actual device drivers to work.